Flood of malware infecting smartphones

The attacks are also starting to hit corporate networks, possibly as part of broader espionage efforts, according to the Juniper Networks Mobile survey.

The report showed a 614% jump in mobile malware in the 12 months to March, with Android attacks accounting for 92%.

The prevalence of Android malware is not surprising in light of its dominance of the global smartphone market, around 75%, Juniper said the open platform with less regulation makes it more prone to attacks.

"Android does not have as rigorous a vetting system" as rival platforms such as Apple's iOS and BlackBerry, said Karim Toubba, a Juniper vice president.

"But the reality is that all the operating systems have vulnerabilities," he added.

Toubba said the dominant scheme to make money from these attacks involves SMS text messages which infect a smartphone and surreptitiously deliver new messages to a "premium" SMS service, for a fee.

These services, which mimic legitimate ones such as those for voting on TV programmes, can charge small fees such as 10 cents or 50 cents.

Money from thousands

The hackers can quickly cash in by infecting large numbers of devices and can easily shut down and set up new numbers to avoid detection.

"They can spin it down and leave no trace," said Toubba.

The typical SMS Trojan takes in a quick US$10 for the attacker, with profits multiplying as the schemes are repeated.

Many users are tricked into installing malware by messages or emails disguised as software updates.

Toubba said some malicious software gets into official channels such as Google Play and the Apple App Store, but that third-party vendors have much more malware.

"These marketplaces are popular targets which provide little or no review processes," Toubba said.

Russia, China churning out malware

Not surprisingly, the survey found many of these malicious apps stemming from sites in Russia and China.

Apple users who "jailbreak" their iPhones to use on unauthorised carrier networks often use these third-party networks because they may get locked out of the App Store.

Many users fail to even notice when their device is infected, because it may result in a charge of just a few cents on their phone bill.

Juniper found that more sophisticated attacks are starting to emerge, including those that create "botnets" to expand the infections, and other schemes which can be part of a broader corporate or government espionage effort.

"They can use the mobile device to do reconnaissance and go deeper into the corporate network," Toubba said.

This is particularly worrisome for companies which allow employees to use their own devices for corporate networks.

Juniper's report said it "saw several attacks that could potentially be used to steal sensitive corporate information or stage larger network intrusions."

"It is clear that the threat of mobile malware to corporate devices is no longer a theoretical one. We expect the presence of mobile malware in the enterprise to grow exponentially in the coming years," the report said.

Source: AFP via I-Net Bridge